The key to information security is protecting information and information systems from unauthorized access through various means. Some common methods of securing information include encryption, authentication, passwords, digital signatures, and controlling access. Public key encryption uses a private and public key system where the private key is known only to the user and the public key can be shared more widely. Encryption scrambles data using an algorithm and key to make it unreadable without the proper key.

2. The Key to Security awareness is embedded in the word security SEC – U – R – IT – Y Information security means protecting information and information systems from unauthorized users. Information security is concerned with the confidentiality, integrity and availability of data regardless of the form the data may take. Most of this information is now collected, processed and stored on electronic computers and transmitted across networks to other computers.

3. Data security is ensuring that data is kept safe from corruption and that access to it is suitably controlled. Thus data security helps to ensure privacy. It also helps in protecting personal data. This is particularly important to ensure individuals are treated fairly, for example for credit checking purposes.

4. In cryptography, encryption is the process of transforming information (referred to as plaintext) using an algorithm (called cipher) to make it unreadable to anyone except those possessing special knowledge, usually referred to as a key. In many contexts, the word encryption also implicitly refers to the reverse process, decryption Encryption is the conversion of data into a form, called a cipher text, that cannot be easily understood by unauthorized people. Computer encryption is based on the science of cryptography , which has been used throughout history. Before the digital age, the biggest users of cryptography were governments, particularly for military purposes

5. Most computer encryption systems belong in one of two categories: Symmetric-key encryption Public-key encryption In symmetric-key encryption , each computer has a secret key (code) that it can use to encrypt a packet of information before it is sent over the network to another computer. Symmetric-key requires that you know which computers will be talking to each other so you can install the key on each one.

6. You create a coded message to send to a friend in which each letter is substituted with the letter that is two down from it in the alphabet. So "A" becomes "C," and "B" becomes "D". You have already told a trusted friend that the code is "Shift by 2". Your friend gets the message and decodes it. Anyone else who sees the message will see only nonsense.

7. Public-key encryption uses a combination of a private key and a public key. The private key is known only to your computer, while the public key is given by your computer to any computer that wants to communicate securely with it. A very popular public-key encryption utility is called Pretty Good Privacy (PGP), which allows you to To implement public-key encryption on a large scale, such as a secure Web server might need, requires a different approach. This is where digital certificates come. A digital certificate is basically a bit of information that says that the Web server is trusted by an independent source known as a certificate authority .

8. A popular implementation of public-key encryption is the Secure Sockets Layer , SSL is an Internet security protocol used by Internet browsers and Web servers to transmit sensitive information. SSL has become part of an overall security protocol known as Transport Layer Security (TLS). Look for the "s" after "http" in the address whenever you are about to enter sensitive information, such as a credit-card number, into a form on a Web site.

9. In your browser, you can tell when you are using a secure protocol, such as TLS, in a couple of different ways. You will notice that the "http" in the address line is replaced with "https," and you should see a small padlock in the status bar at the bottom of the browser window. The padlock symbol lets you know that you are using encryption

10. The key in public-key encryption is based on a hash value . This is a value that is computed from a base input number using a hashing algorithm . The important thing about a hash value is that it is nearly impossible to derive the original input number without knowing the data used to create the hash value.

11. You can see how hard it would be to determine that the value 1,525,381 came from the multiplication of 10,667 and 143. But if you knew that the multiplier was 143, then it would be very easy to calculate the value 10,667. Public-key encryption is actually much more complex than this example, but that is the basic idea. Input number Hashing algorithm Hash value 10,667 input * 143 1,525,381

12. Authentication , is used to verify that the information comes from a trusted source. Basically, if information is "authentic," you know who created it and you know that it has not been altered in any way since that person created it. These two processes, encryption and authentication, work hand-in-hand to create a secure environment .

13. Password - The use of a user name and password provides the most common form of authentication. Pass cards - These cards can range from a simple card with a magnetic strip, similar to a credit card, to sophisticated smart cards that have an embedded Digital signatures - A digital signature is basically a way to ensure that an electronic document (e-mail, spreadsheet, text file) is authentic. The Digital Signature Standard (DSS) is based on a type of public-key encryption method that uses the Digital Signature Algorithm (DSA).

14. One very important feature of a good encryption scheme is the ability to specify a 'key' or 'password' of some kind, and have the encryption method alter itself such that each 'key' or 'password' produces a different encrypted output, which requires a unique 'key' or 'password' to decrypt There are few operations in mathematics that are truly 'irreversible'. In nearly all cases, if an operation is performed on 'a', resulting in 'b', you can perform an equivalent operation on 'b' to get 'a'. In some cases you may get the absolute value (such as a square root), or the operation may be undefined (such as dividing by zero).

15. The IBM 4758 is an extremely secure cryptographic co-processor. It is used by banking systems and in other security conscious applications to hold keying material. It is designed to make it impossible to extract this keying material unless you have the correct permissions and can involve others in a conspiracy. Can we crack this???

16. The DES cracker is searching a 2 56 key space (72,058,000,000,000,000 keys) at a speed of 33.333 MHz (i.e. 33.333 million keys/second). To search the entire key space would therefore take 68.50 years . The DES cracker is actually searching for up to 16384 keys in parallel. If the whole key space was searched it would find keys at an average rate of one per 68.50/16384 years, which is one every 36.65 hours. To calculate the expected time until the first key is found, one treats the system as having a Poisson distribution. Since the linear feedback shift back register is walking the key space pretty much at random this is a reasonable assumption.

17. So we have 2 56 possible keys in the key space and 2 14 possible matches. Let the mean rate of matching be m = 2 14 / 2 56 = 2 -42 The probability that any particular cell is empty is (m 0 / 0!) e -m Simplifying this (m 0 = 1 and 0! = 1) we get the probability that a cell is empty = e -m Let the probability that the first r cells are empty be p Then p = (e -m ) r [independent events] So p = e -mr Taking the natural log of both sides and solving for r we have r = -ln(p) / m

18. So for a probability, p, equal to 0.5 (i.e. average luck ) for our value of m we need to search r keys where r = 0.6931472 / 2.2737734E-13 = 3,048,497,000,000 keys. At 33.333MHz this will take 25.40 hours . Note carefully that if your luck is worse, then one time in a thousand cracking attempts (i.e.: p = 0.001) then a lot more keys will need to be searched. In fact it will take about 10.5 days at 33.333MHz. In practice we've had cracks that ran in times between 5 and 37 hours -- so we've never been especially unlucky RESULTS

19. Requirements You need access to a live IBM 4758 i.e. one that protects real key material, in a real bank. Because of the access permissions required, this sort of attack requires you to be a bank manager or security officer that plays a part in manual key entry into the device. In practice there might be about three or four people in the bank with the relevant access privileges. If your insider is not one of these people, there are plenty of ways you can go about stealing one of their passwords.

20. Information security is the ongoing process of exercising due care and due diligence to protect information, and information systems, from unauthorized access, use, disclosure, destruction, modification, or disruption or distribution. The never ending process of information security involves ongoing training, assessment, protection, monitoring & detection, incident response & repair, documentation, and review